What cybersecurity has taught me about crisis management

Lexie Gunther is vice president at Method Communications. 

When news travels at the speed of social media, a crisis response, by definition, is almost too late. Without a crystal ball to predict when things may go awry, there are a few actions that communicators can take to hopefully prevent, but at least get ahead of, unfortunate situations. 

As someone who works with a lot of cybersecurity brands, it’s nearly impossible to ignore the parallels to crisis communications. Just as cybersecurity companies aim to prevent, detect and respond to digital threats, PR professionals can and should be taking steps to prevent, detect and respond to reputational threats. The important distinction is knowing how to “shift left,” or get ahead of issues before they materialize. 

In short, if you know how to identify the signals that may indicate trouble ahead, you can act before trouble reaches you. Here’s how:

Visibility is vital

When a crisis occurs, there is often the less-than-helpful, but ever-present question: How did this happen? From the outside, it’s an easy question to hurl at a team in the middle of dealing with the aftermath, but there’s rarely a simple answer. 

It is continually surprising – and alarming – how siloed communications can be from and between different areas of a business. And a lack of awareness can put you on your heels in a crisis. Even if a business’ communications team is not directly involved in a given initiative, they should always have visibility into any activity that could impact internal and external stakeholders. Fortunately, organizations are seeing the value in having communications ingrained into business strategy, as CCO positions are on the rise and more are reporting directly to the CEO.

Whether you’re working internally at a company or as an agency partner, it’s absolutely critical to know how the company is engaging with its audiences, from employees and customers to industry peers, as well as  the media. If your organization hasn’t evolved to bring communications into the executive lineage and you’re unsure how much (or little) visibility you have, start by meeting with department heads to create more cohesion between teams. 

Before doing so, make sure you prepare to get the most out of your meeting – and set yourself up for long-term success. Plan to discuss their strategic initiatives or upcoming campaigns, priorities and goals, as well as an audit of their own communications channels such as demand generation emails or sales scripts. This will give you insight into if, and how, they’re communicating with stakeholders, and allows you to identify any potential friction areas. A plus: you may even get new ideas from what other teams are doing successfully. 

Finally, ensure you have external visibility. Set up, or update, your news media and social media monitoring activities with sentiment analysis to see real-time conversations about your brand, executives, and products or services. These search terms should be updated at least quarterly to make sure you have the most accurate information. Personnel changes, product suites expand, and geographic profiles shift – don’t forget to update your news and social alerts when these things occur.

Situational awareness and landscape assessment

Once the communications team is integrated into all the necessary areas of the business, they can then begin to properly survey their surroundings to capture a more complete picture of the company’s risk profile. By knowing all the channels of communication and key stakeholders, you can inventory – and prioritize based on severity and likelihood – all potential crises that could occur, from product delays or changes in employee benefits to man-made and natural disasters.

But that’s only a one-dimensional way of understanding your risk. For a more complete situational analysis, monitor for industry trends and news about your competitors. Just as you monitor your own digital reputation, you can glean a lot of information about potential threats to your brand from others in the industry (especially your competitors) – and how they respond. 

Take the recent global IT outage. Even if a similar scenario is extremely unlikely at your business, you can learn from this very visible event. For example, if you work at a software or IT company, know when the product tests or updates are scheduled, so you can plan for potential challenges, or in worst cases, failures. Beyond IT and software, companies across industries can take a lesson from how to manage when systems go offline. 

As always, relationships matter 

In PR, we’re always thinking about our relationships. They are just as important, if not more, to crisis management. To achieve more visibility, you have to build rapport with your colleagues and ensure your collaboration isn’t at the cost of their productivity or success. Tactfully align yourself and the communications program with other areas of the business. If done properly, they will be more willing to share information and proactively bring you into conversations and plans.

One notable example is the fraudulent hire phenomenon where nefarious actors disguised as contract employees attempt to access sensitive or proprietary data. What might first look like an HR problem is actually much more complex, and could quickly escalate to a crisis management problem for your brand. But with communications and HR working more closely, you not only have line of sight into recruitment and hiring, such as working hand-in-hand on job descriptions and LinkedIn postings, but have a better opportunity to get ahead of a hire-gone-wrong scenario. 

Crises aside, having healthy relationships with your colleagues can also benefit your overall communications goals. Understanding their concerns, priorities, goals and successes can help inform your communication style and format for a more effective approach. 

Ultimately, every crisis situation is unique. Having more visibility into the whole of the business is a moving target and just like cybersecurity, it’s more often a “when” not “if” scenario in terms of crises – whether severe or fleeting. 

Even if you follow these tips, it won’t guarantee something won’t go wrong. If I could do that, I’d be offering very different advice (see earlier: crystal ball). However, they will set you up for success in preventing a crisis from proliferating, or at least give you a more informed approach in mitigating them as they arise.